A passive transmitter for quantum key distribution with coherent light 
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Signal state preparation in quantum key distribution schemes can be realized using either an 
active or a passive source. Passive sources might be valuable in some scenarios; for instance, in 
those experimental setups operating at high transmission rates, since no externally driven element 
is required. Typical passive transmitters involve parametric down-conversion. More recently, it has 
been shown that phase-randomized coherent pulses also allow passive generation of decoy states 
and Bennett-Brassard 1984 (BB84) polarization signals, though the combination of both setups in 
a single passive source is cumbersome. In this paper, we present a complete passive transmitter 
that prepares decoy-state BB84 signals using coherent light. Our method employs sum- frequency 
generation together with linear optical components and classical photodetectors. In the asymptotic 
limit of an infinite long experiment, the resulting secret key rate (per pulse) is comparable to the 
one delivered by an active decoy-state BB84 setup with an infinite number of decoy settings. 



I. INTRODUCTION 

Quantum key distribution (QKD) is already a mature 
technology that can provide cryptographic systems with 
an unprecedented level of security It aims at the 
distribution of a secret key between two distant parties 
(typically called Alice and Bob) despite the technologi- 
cal power of an eavesdropper (Eve) who interferes with 
the signals. This secret key is the essential ingredient of 
the one-time- pad or Vernam cipher Q, the only known 
encryption method that can offer information-theoretic 
secure communications. 

Most practical long-distance implementations of QKD 
are based on the so-called BB84 protocol, introduced 
by Bennett and Brassard in 1984 Q, in combination 
with the decoy-state method 0-ll|. In a typical quan- 
tum optical implementation of this scheme, Alice sends 
to Bob phase-randomized weak coherent pulses (WCPs) 
with different mean photon numbers that are selected, in- 
dependently and randomly, for each signal. These states 
can be generated using a standard semiconductor laser 
together with a variable optical attenuator that is con- 
trolled by a random number generator (RNG) [9]. Each 
light pulse may be prepared in a different polarization 
state, which is selected, again independently and ran- 
domly for each signal, between two mutually unbiased 
bases, e.g., either a linear (H [horizontal] or V [vertical] ) 
or a circular (L [left] or R [right]) polarizations basis [lOj . 
For that, two main experimental configurations are typ- 
ically used. In the first one, Alice employs four laser 
diodes, one for each possible BB84 signal [ll|. These 
lasers are controlled by a RNG that decides each given 
time which one of the four diodes is triggered. The second 
configuration utilizes only one laser diode in combination 
with a polarization modulator [i~2| . This modulator ro- 
tates the state of polarization of the signals depending 
on the output of a RNG. On the receiving side, Bob 
measures each incoming signal by choosing at random 



between two polarization analyzers, one for each possi- 
ble basis. Once the quantum communication phase of 
the protocol is completed, Alice and Bob use an authen- 
ticated public channel to process their data and obtain 
a secure secret key. This last procedure, called key dis- 
tillation, involves, generally, local randomization, error 
correction to reconcile Alice's and Bob's data, and pri- 
vacy amplication to decouple their data from Eve [l3[ . A 
full proof of the security for the decoy-state BB84 QKD 
protocol with WCPs has been given in Refs. 043 • 

Alternatively to the active signal state preparation 
methods described above, Alice may as well employ a 
passive transmitter to generate decoy-state BB84 signal 
states. This last solution might be desirable in some 
scenarios; for instance, in those experimental setups op- 
erating at high transmission rates, since no RNGs are 
required in a passive device |14Tjl9j . Passive schemes 
could also be more robust against side-channel attacks 
hidden in the imperfections of the optical components 
than active sources. The working principle of a passive 
transmitter is rather simple. For example, Alice can use 
various light sources to produce different signal states 
that are sent through an optics network. Depending 
on the detection pattern observed in some properly lo- 
cated photodetectors, she can infer which signal states 
are actually generated. Known passive schemes rely typ- 
ically on the use of a parametric down-conversion (PDC) 
source, where Alice and Bob passively and randomly 
choose which bases to measure each incoming pulse by 
means of a beamsplitter (BS) [l9j]. Also, Alice can ex- 
ploit the photon number correlations that exist between 
the two output modes of a PDC source to passively gen- 
erate decoy states [15j ■ More recently, it has been shown 
that phase-randomized coherent pulses are also suitable 
for passive preparation of decoy states [H, [ijj and BB84 
polarization signals [20| , though the combination of both 
setups in a single passive source is cumbersome. Intu- 
itively speaking, Refs. [H, Qjl H3| take advantage of the 
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considering, for simplicity, the interference of two pure 
coherent states of frequency W\, both prepared in +45° 
linear polarization and with arbitrary phase relationship, 
^ ei )ao,+45° and |V2Me^) 60)+45o , at a 50 : 50 BS. 
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FIG. 1. Basic setup of a passive decoy-state BB84 QKD 
source with polarization encoding using phase-randomized 
strong coherent pulses. The mean photon number of the sig- 
nal states pi, with i £ {1, . . . ,4}, can be chosen very high; 
for instance, ~ 10 s photons. BS denotes a beamsplitter, PBS 
represents a polarizing beamsplitter in the ±45° linear polar- 
ization basis [25| | . F is an optical filter, R denotes a polariza- 
tion rotator changing +45° linear polarization to —45° linear 
polarization, |vac) represents the vacuum state, and t denotes 
the transmittance of a BS; it satisfies t< 1. 



random phase of the different incoming pulses to pas- 
sively generate states with either distinct photon number 
statistics but with the same polarization WL Tjj , or with 
different polarizations but equal intensities [20j . 

In this article, we present a complete passive transmit- 
ter for QKD that can prepare decoy-state BB84 signal 
states using coherent light. Our method employs sum- 
frequency generation (SFG) [2l|, [22| together with linear 
optical components and classical photodetectors. SFG 
has already exhibited its usefulness in quantum informa- 
tion [23| and device-independent QKD [24| at the single- 
photon level. Here we use it in the conventional non- 
linear optics paradigm with strong coherent light. This 
fact might render our proposal particularly valuable from 
an experimental point of view. In the asymptotic limit 
of an infinite long experiment, it turns out that the se- 
cret key rate (per pulse) provided by such passive scheme 
is similar to the one delivered by an active decoy-state 
BB84 setup with infinite decoy settings. 

The paper is organized as follows. In Sec. [TT] we 
introduce a passive transmitter that generates decoy- 
state BB84 polarization signal states using coherent light. 
Then, in Sec. IHII we evaluate its performance and we ob- 
tain a lower bound on the resulting secret key rate. In 
Sec. |IV] we consider the case where Alice and Bob use 
phase-encoding, which is more suitable to employ in com- 
bination with optical fibers than polarization encoding. 
Finally, Sec. [V] concludes the article with a summary. 
The paper includes as well some Appendixes with addi- 
tional calculations. 



II. PASSIVE DECOY-STATE BB84 
TRANSMITTER 

The basic setup is illustrated in Fig. [T] Let us start 
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Then, we have that the output states in modes c\ and d\ 
have the form 
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a nonlinear medium using the SFG process, the resulting 
output states at frequency W3 — W1+W2, after the polar- 
ization rotation R, can be written as (see Appendix |A"|) 



- v /Me' S3 (e' s i+ e ' fl 2) 
V2 



c 2 ,+45° 



-^Je ifl 4( e ^ 1+e i9 2) 

V2 'd 2 .-45° 



(3) 

These two beams are now re-combined at a PBS in the 
±45° linear polarization basis [25j. We obtain that the 
output state in mode 03 (see Fig. [T]) is a coherent state 
of the form 
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where C(0) = 2/1,(1 + cos0), = 2 - 0i, <f> = tt + 9 X + 
03 + arg (I + e l6 ), and the Fock states \n^) are given by 
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with I vac) denoting the vacuum state and ip = 64 — 63. 
Finally, Alice sends the quantum state given by Eq. (|4]) 
through a BS of transmittance f < 1. Then, the output 
states in modes C3 and d% are given by 



(6) 



The analysis of the case where the global phase of 
each input signal pi, with i G {I,..., 4}, is random- 
ized and inaccessible to the eavesdropper is now straight- 
forward . It can be solved by just int egrating the sig- 
nals |^9je«)^ and W [l - t)Q(9)e^) ^ given by 
Eq. ([5]) over all angles 0, <fi, and ip. In particular, we have 
that the output state a in this scenario (see Fig. [IJ can 
be written as 
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where the intensity 7(0) is given by 7(0) = t((9). 



3 



The weak intensity signal a in mode C3 is suitable for 
QKD and Alice sends it to Bob through the quantum 
channel. Also, she uses the strong intensity signal avail- 
able in mode to measure both its intensity and po- 
larization. This last measurement can be realized, for 
example, by means of a passive BB84 detection scheme 
where the basis choice is performed by a 50 : 50 BS, and 
on each end there is a PBS and two classical photodetec- 
tors. From the different intensities observed in each of 
these four photodetectors, Alice can determine both the 
value of the angle ip and the total intensity of the signal. 
Note that, by assumption, we have that the intensity of 
the input states pi is very high. 

For simplicity, let us assume for the moment that 
the polarization measurement is perfect, i.e., for each 
incoming signal it provides Alice with a precise value 
for the measured angle ip, while the intensity measure- 
ment only tells her whether the measured intensity is 
below or above a certain threshold value A that satisfies 
< A < 4/i(l — t). That is, A is between the minimal 
and maximal possible values of the intensity (1 — i)C(0) 
of the optical pulses in mode d% . The first intensity in- 
terval, £d = [0, A], can be associated, for instance, to the 
generation of a decoy state in output mode C3 (that we 
shall denote as ad), while the second intensity interval, 
£ s = [A, 4/i(l — t)], corresponds to the case of preparing 
a signal state (<r s ). Note, however, that the analysis pre- 
sented in this section can be straightforwardly adapted 
to cover as well the case of several intensity intervals £j 
(i.e., the generation of several decoy states). Figure [5] 
(case A) shows a graphical representation of the intensity 
(1 — t)C(0) in mode d 3 versus the angle 9, together with 
the threshold value A and the intensity intervals £d and 
£ s . The threshold angle 9\ that satisfies (l — t)((9j\) = A 
is given by 
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In this simplified scenario, the conditional quantum 
states that are sent to Bob can be written as 
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where i = {s, d}, and the probabilities p l n are given by 
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In practice, however, it is not necessary that Alice de- 
termines the value of ip accurately and restricts herself 
to only those events where she actually prepares a per- 
fect BB84 polarization state (Le., when the angle ip sat- 
isfies ip € {0,7r/2, 7r,37r/2}) 20]. Note that the proba- 
bility associated with these ideal events tends to zero. 
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FIG. 2. (Case A) Graphical representation of the intensity 
(1 — t)£(8) in mode c?3 (see Fig. [1} versus the angle 9. A 
represents the threshold value of the classical intensity mea- 
surement, 9a is its associated threshold angle, and £d and £ s 
denote the resulting intensity intervals. (Case B) Graphical 
representation of the valid regions for the angle ip. These 
regions are marked in gray. They depend on an acceptance 
parameter £ [0,7r/4]. 



Instead, it is sufficient if the polarization measurement 
tells her the value of ip within a certain interval around 
the desired ideal values. This situation is illustrated in 
Fig. (case B), where Alice selects some valid regions 
(marked with gray color in the figure) for the angle ip 
[20J. These regions depend on an acceptance parameter 
G [0,7r/4] that we optimize. In particular, whenever 
the value of ip lies within any of the valid regions, Alice 
considers the pulse emitted by the source as a valid sig- 
nal. Otherwise, the pulse is discarded afterwards during 
the post-processing phase of the protocol, and it does not 
contribute to the key rate. The probability that a pulse 
is accepted, p acc , is given by 



Pace — -1 ■ 
TT 



(11) 



There is a trade-off on the acceptance parameter 17. 
A high acceptance probability p acc favors « 0, but 
this action also results in an increase of the quantum bit 
error rate (QBER) of the protocol. A low QBER favors 
il sa tt/4, but then p acc w 0. Note that in the limit where 

tends to 7r/4 we recover the standard decoy-state BB84 
protocol. 
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III. LOWER BOUND ON THE SECRET KEY 
RATE 

We shall consider that Alice and Bob treat decoy and 
signal states separately, and they distill secret key from 
both of them. For that, we use the security analysis 
presented in Ref. [f|, which combines the results pro- 
vided by Gottesman-Lo-Lutkenhaus-Preskill (GLLP) in 
Ref. [27| (see also Ref. [28|]) with the decoy-state method 
[29l | . The secret key rate formula can be written as 



R>^Pt max{i? 4 ,0}, 



(12) 



with i = {s,d}. Here pi denotes the probability to gen- 
erate a state associated to the intensity interval £j (i.e., 
p s = 6> A /7T and p d = 1 - p s ), and 

R l > <ZPacc{ - Q l f(E*)H(E*) +p\Y 1 [l - H(ex)] 

+ PhY }. (13) 

The parameter q is the efficiency of the protocol (q = 1/2 
for the standard BB84 scheme, and q ~ 1 for its efficient 
version [3(|); Q % denotes the gain, i.e., the probability 
that Bob obtains a click in his measurement apparatus 
when Alice sends him a signal Oi, f(E l ) represents the 
efficiency of the error correction protocol as a function of 
the error rate E % , typically f(E l ) > 1 with Shannon limit 



f(E l ) = 1 [31[; Y n is the yield of an n-photon signal, i.e., 
the conditional probability of a detection event on Bob's 
side given that Alice transmits an n-photon state; e„ 
denotes the error rate of an n-photon signal; and H(x) = 
— a;log 2 (x) — (1 — x) log 2 (1 — x) represents the binary 
Shannon entropy function. 

For simulation purposes, we shall consider a simple 
channel model in the absence of eavesdropping [||, @] ; it 
just consists of a BS whose transmittance depends on the 
transmission distance and the loss coefficient of the quan- 
tum channel. That is, for simplicity, we neglect any mis- 
alignment effect in the channel. Furthermore, we assume 
that Bob employs an active BB84 detection setup. This 
model allows us to calculate the observed experimental 
parameters Q l and E l . These quantities are given in 
Appendix [Bj Our results, however, can also be straight- 
forwardly applied to any other quantum channel or de- 
tection setup, as they depend only on the observed gain 
and QBER. 

To evaluate the secret key rate formula given by 
Eq. (IIUI) we need to estimate the yields Y and Yi, to- 
gether with the single-photon error rate e\, by solving 
the following set of linear equations: 



= y^.Pn Y n, and 



OO 

n=0 



(14) 



For that, we shall use the procedure proposed in Refs. [7, 
Moreover, we will assume a random background 
(i.e., eo = 1/2). This method requires that the prob- 
abilities p % n given by Eq. (fTU|) satisfy certain conditions 
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FIG. 3. Lower bound on the secret key rate R given by 
Eq. (|12p in logarithmic scale for the passive transmitter with 
two intensity settings illustrated in Fig. [TJ (green line). For 
simulation purposes, we consider the following experimen- 
tal parameters: the dark count rate of Bob's detectors is 
£b = 3.2 x 10 -7 , the overall transmittance of Bob's detection 
apparatus is «b = 0.045, the loss coefficient of the channel 
is a — 0.2 dB/km, q = 1/2, and the efficiency of the error 
correction protocol is f(E l ) = 1.22. We further assume the 
channel model described in Refs. [1,0], where we neglect any 
misalignment effect. Otherwise, the actual secure distance 
will be smaller. The inset figure shows the value for the op- 
timized parameters fit (dashed line) and Q (solid line) in the 
passive setup. The optimal value for the threshold parameter 
A turns out to be constant with the distance and equal to 
2fi(l — i), i.e., the threshold angle 9a satisfies 9a = n/2. The 
black line represents a lower bound on R for an active asymp- 
totic decoy-state BB84 system with infinite decoy settings [g], 
while the red line shows the case of a passive transmitter with 
infinite intensity intervals (see Appendix |D|) . 



that we confirm numerically. The results are included 
in Appendix [Cj It is important to emphasize, however, 
that the estimation technique presented in Refs. 0, H?} 
only constitutes a possible example of a finite setting es- 
timation procedure. In principle, many other estimation 
methods are also available for this purpose, such as linear 
programming tools [32| . which might result in sharper, or 
for the purpose of QKD, better bounds on the considered 
probabilities. 

The resulting lower bound on the secret key rate with 
two intensity settings is illustrated in Fig. [3] (green line). 
In our simulation we employ the following experimental 
parameters: the dark count rate of Bob's detectors is 
£b = 3.2 x 1CP 7 , the overall transmittance of Bob's de- 
tection apparatus is ne = 0.045, and the loss coefficient 
of the channel is a = 0.2 dB/km. We further assume that 
q = 1/2, and f(E i ) = 1.22. With this configuration, it 
turns out that the optimal value of the parameter \it de- 
creases with increasing distance, while the optimal value 
of the parameter Q increases with the distance. A similar 
behavior was also observed in the passive BB84 trans- 
mitter (without decoy states) proposed in Ref. [20(. In 
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particular, /it diminishes from w 0.175 to « 0.125, while 
f2 augments from w 0.393 to s» 0.7. At long distances the 
gain of the protocol is very low and, therefore, it is im- 
portant to keep both the multi-photon probability of the 
source (related with the parameter p£) and the intrinsic 
error rate of the signals sent by Alice (related with the 
parameter £1) also low. Figure [3] includes as well an inset 
plot with the optimized parameters [it (dashed line) and 
f2 (solid line). The optimal value for the parameter A 
turns out to be constant with the distance; it is given by 
A = 2ju(l — t), i.e., the threshold angle 9a is equal to ir/2. 
This figure also shows a lower bound on the secret key 
rate for the cases of an active decoy-state BB84 system 
with infinite decoy settings (black line) || , and a passive 
transmitter with infinite intensity intervals £, (red line). 
The cutoff points where the secret key rate drops down 
to zero are « 181 km (passive setup with two intensity 
settings), « 183 km (passive setup with infinite intensity 
settings), and rs 192 km (active transmitter with infi- 
nite decoy settings). From the results shown in Fig. [3] 
we see that the performance of the passive transmitter 
presented in Sec. UH with only two intensity settings, is 
similar to that of an active asymptotic setup, thus show- 
ing the practical interest of the passive scheme. The rel- 
atively small difference between the achievable secret key 
rates in both scenarios is due to two main factors: (a) the 
intrinsic error rate of the signals accepted by Alice, which 
is zero only in the case of an active source, and (b) the 
probability p acc to accept a pulse emitted by the source, 
which is Pace < 1 in the passive setup and p aC c = 1 in 
the active scheme. For instance, we have that for most 
distances ft w 0.393, which implies p acc « 0.5. This fact 
reduces the key rate on logarithmic scale of the passive 
transmitter by a factor of log 10 Pace 

« 0.3. The addi- 
tional factor of s» 0.45 that can be observed in Fig. [3] 
arises mainly from the intrinsic error rate of the signals. 



IV. PHASE ENCODING 

Similar ideas to the ones presented in Sec.|TT]can also be 
used in other implementations of the decoy-state BB84 
protocol with a different signal encoding. For instance, in 
those QKD experiments based on phase encoding, which 
is more suitable to use with optical fibers than polariza- 
tion encoding, which is particularly relevant in the con- 
text of free-space QKD [l|. 

The basic setup is illustrated in Fig. @] Again, for 
simplicity, let us consider first the case where the input 
signals pi, with i € {1, ... ,4}, are pure coherent states 
with arbitrary phase relationship: \^/2p,e 1 ) a +45Q and 

\^/2jle i02 ) bo +ibo (of frequency w%), and lv7*e ifl3 ) 03)+450 
and \^/JJe l9i ) b2 +45<) (of frequency w 2 ). Let At denote the 
time difference between two consecutive pulses generated 
by the sources. Then, from Sec. |TT] we have that the 
signals in modes C2 and d 2 at time instances t and t+At/2 
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FIG. 4. Basic setup of a passive decoy-state BB84 QKD 
source with phase encoding. The delay introduced by one 
arm of the interferometer is equal to half the time difference 
At between two consecutive pulses. 



can be written as 
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where 
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3. Similarly, we find that the quan- 



tum states in modes C3 and d^ are given by, respectively, 
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The case of phase-randomized strong coherent pulses 
is completely analogous to that of Sec. Inland we omit it 
here for simplicity; it results in an uniform distribution 
for the angles 9, (j>, and <\>' for both pairs of pulses given 
by Eq. (TtJ)) . The strong signals in mode d 3 are used to 
measure both their phases, relative to some local refer- 
ence phase, and their intensities by means of an intensity 
and phase measurement, while Alice sends the weak sig- 
nals in mode C3 to Bob. Again, just like in the passive 
source with polarization encoding shown in Fig. [1] Alice 
can now select some valid regions for the measured phases 
and also distinguish between different intensity settings. 
Then, we have that the analysis and results presented in 
Sec. IIIII also apply straightforwardly to this scenario. 



V. CONCLUSION 

In this paper, we have introduced a complete pas- 
sive transmitter for QKD that can prepare decoy-state 
Bennett-Brassard 1984 signal states using coherent light. 
Our method employs sum-frequency generation together 
with linear optical components and classical photode- 
tectors, and constitutes an alternative to those active 
sources that are typically used in current experimental 
realizations of QKD. In the asymptotic limit of an infi- 
nite long experiment, we have proven that such passive 
scheme can provide a secret key rate (per pulse) similar 
to the one delivered by an active decoy-state BB84 setup 
with infinite decoy settings, thus showing the practical 
interest of the passive scheme. 
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The main focus of this paper has been polarization- 
based realizations of the BB84 protocol, which are par- 
ticularly relevant for free-space QKD. However, we have 
also shown that similar ideas can as well be applied to 
other practical scenarios with different signal encodings, 
like, for instance, those QKD experiments based on phase 
encoding, which are more suitable for use in combination 
with optical fibers. 



VI. ACKNOWLEDGMENTS 

We thank F. Steinlechner for helpful discussions. 
M.C. thanks the University of Toronto for hospitality 
and support during his stay in this institution. This 
work was supported by Xunta de Galicia, Spain (grant 
No. INCITE08PXIB322257PR), by ERDF funds under 
the project Consolidation of Research Units 2008/075, 
and by the Ministerio de Education y Ciencia, Spain 
(grants TEC2010-14832, FIS2007-60179, FIS2008-01051 
and Consolider Ingenio CSD2006-00019). 



Appendix A: Sum-frequency generation 

For completeness, in this Appendix we include the 
calculations to derive Eq. (|3]) in Sec. HU Our starting 
point are the input states to one of the two SFG pro- 
cesses used in the passive transmitter illustrated in Fig.Q] 
|yE (e *i +e^)) ci +450 and \^e^) a ^ . Such pro- 

cess is described by the Hamiltonian H = ihx{ci<i2C2 — 
H.c), where c 2 represents the creation operator for the 
light wave at frequency W3 = w\ + W2 [22]. The pa- 
rameter x is a coupling constant that is proportional to 
the second-order susceptibility x^ of the nonlinear ma- 
terial, and H.c. denotes a Hermitian conjugate. When 
the pump mode at frequency W2 is kept strong and unde- 
pleted, then this mode can be typically treated classically 
as a complex number. With this assumption, we have 
that the effective Hamiltonian above can now be written 
as H = ihxiy/Jie' 193 c\c\ — H.c). Using the Heisenberg 
equation of motion, it is straightforward to obtain the 
following coupled-mode equations: 

^ = -xV»e- W3 C2, ^ = xVf"" a cu (Al) 

which can be solved in terms of initial values at t = to 
yield 

ci(t) = ci(0) cos (VMX*) - e- t93 c 2 (0) sin (^MX*) 
c 2 (t) = c 2 (0) cos (VMX*) + e i8s ci(0) sin {yfjx X t). (A2) 

At the point of complete conversion, t c — tt / (2y/JIx), we 
obtain 

c\(t c ) = -e ie3 4(0), 4(t c ) = e- i03 4(O). (A3) 



That is, at time t c we find that the resulting output state 
at frequency W3 from the SFG process is given by 

|-yfe^( e ^ +e ^)) C2+45o . (A4) 

Appendix B: Gain and QBER 

In this Appendix, we obtain a mathematical expres- 
sion for the observed gains Q z and error rates E l , with 
i € {s, d}, for the passive QKD transmitter with two 
intensity settings introduced in Sec. UH For that, we em- 
ploy the typical channel model in the absence of eaves- 
dropping jll Q; it just consists of a BS of transmittance 
^channel = IO^t^, where a denotes the loss coefficient of 
the channel measured in dB/km and d is the transmis- 
sion distance. Moreover, for simplicity, we consider that 
Bob employs an active BB84 detection setup with two 
threshold detectors. 

The action of Bob's measurement device can be 
described by two positive operator value measures 
(POVMs), one for each of the two BB84 polarization 
bases f3 € {l,c}, with I denoting a linear polarization 
basis and c a circular polarization basis. Each POVM 
contains four elements: G^ ac , Gq, G^, and G^ c . The 
first one corresponds to the case of no click in the detec- 
tors, the following two POVM operators give precisely 
one detection click, and the last one, G^ c , gives rise to 
both detectors being triggered. These operators can be 
written as [20] 

G^ c = [l-e B (2- eB )]F£ c , 

G p =(l-e B )e B F v ^ + (l-e B )Fi, 

G^ = (l-e B )e B F v { c + (l-e B )F^ 

Gl c = t-G^-G^-Gl (BI) 

Here we assume that the background rate is, to a 
good approximation, independent of the signal detec- 
tion. Moreover, for easiness of notation, we consider only 
a background contribution coming from the dark count 
rate e B of Bob's detectors and we neglect other back- 
ground contributions like, for instance, stray light arising 
from timing pulses which are not completely filtered out 
in reception. The operators F@ acl Fq , f£ , and F^ c have 
the form 

00 

FL= E (l-Vsy S ) n+m \n,m)e(n,ml 

n,m—0 
00 

F o= E [i-(i-% s )"](i-y m K™) P («,™l, 

n,m— 
00 

F i= E [l-(l-»?sy s n(l-%ys) n |n,m)^n,m|, 

n,m— 
00 

F l = E P- - - - (1 - ^ ys ) m ] 

n,m— 

x |n, m) o{n, m|, (B2) 
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with j3 S {l,c}. The signals |n,rn) z (\n,m) c ) represent 
the state which has n photons in the horizontal (circu- 
lar left) polarization mode and m photons in the vertical 
(circular right) polarization mode. The parameter rj sys 
denotes the overall transmittance of the system. This 
quantity can be written as 77 sys = tjb ^channel, where 773 is 
the overall transmittance of Bob's detection apparatus, 
i.e., it includes the transmittance of any optical compo- 
nent within Bob's measurement device together with the 
efficiency of his detectors. 

In the scenario considered, it turns out that the gains 
Q l are independent of the actual polarization of the sig- 
nals given by Eq. © and the basis (3 used to measure 
them. We obtain 



Q l = 1 - Tr(G^ c a^ 
= 1 - 



(1-^b) 2 



-n*.7W d9, (B3) 



where p s = 9 A /ir, p d = 1 - p s , % = [0,0a], and 9 id = 
[0A,4 

When 8\ = ir/2, which is the value that maximizes the 
secret key rate formula given by Eq. (|12[) . we have that 
the gains Q l can be written as 



Q s = 1-(1- e B ) 2 A-fe ys C), 
Q d = I-(I-e B ) 2 A + (?7 sys C), 



(B4) 



(B5) 



where £ = 2/ji, and 

A±(x) =e~ x [l 0iX ±L , x ]. 

Here I qiZ represents the modified Bessel function of the 
inc 

These functions are defined as 1 35 



first kind, and L q>z denotes the modified Struve function. 



I qz = — 4 eW^+Wt-^dt, 



(B6) 



L„ 



29- 1 0Fr 9+1/2 J 



tt/2 



sinh (z cos 9) sin 9 2q d9. 



The error rates E l depend on the value of the angle 
ip. By symmetry, we can restrict ourselves to evaluate 
the QBER in only one of the valid regions for ip. Note 
that is the same in all of them. For instance, let us 
consider the case where ip € [7ir/4 + fi,7r/4 — fi] (which 
corresponds to the horizontal polarization interval), and 



let denote the error rate of a signal cr,^ in that region. 
This quantity can be written as 



4 = ^ 



@1 + o^dc I a i,i> 



(B7) 



Here we have considered the typical initial post- 
processing step in the BB84 protocol, where double-click 
events are not discarded by Bob, but are randomly as- 
signed to single-click events. Equation (|B7|) can be fur- 
ther simplified as 



4 = ^{ £B ( eB - VK,* + P + £ b(£b - 3)]/^ 



(B8) 



where /j^ = Tr(_Fjcr-^). After a short calculation, we 

-Vsy a y(e) _ l _|_ e 3>) syB 7(9)(l+cosl/') 
-»7Bys7(f) _ I _|_ e 5*y=7(e)(l-cosV) 



obtain 








1 

Pi 71" 






1 




fi — 

J dc,^ 


1 + 


1 

PiTT 



_ e -h r ] S ysi(8)(^-+z°s4>) d9. (B9) 
When 0a = 7r/2, these expressions can be simplified as 

-A-{r hyB C)+A-[K+(fl>)], (BIO) 
-A + (f] sys + A+[K+{ijj)}, 
-A-(rhy,Q + A-[k-(i/>)], 
-A+{rj sys + A+[k-(^)\, 
1 + A_fe ys C) - A-[e+W>)] - A_[e_(V)], 
1 + A+^sC) - A + [e+(^)] - A+[e_(^)], 
where the parameters n±(ip) an d e±(V0 have the form 

«±(V')='7sy S C[l-(l±COsV)/2], 

e±(V)=77sy 8 C(l±cosV0/2. (BII) 
The quantum bit error rates -E 1 are then given by 

£, =^0- d *' <bi2) 

Combining Eqs. (|B8|) - (|BI0llBT2l) . we find that 



•'0,1/1 
/i,V> 

J dc,i/> 
J dc,tp 



E" = ^ I |l-(l-e B ) 2 A_(7 7sys C) + 



e B (e B - + [2 + e B (e B - 3)]A_[«_(^)] 



(l- eB ) 2 [A_[e + (^)]+A_[e_(^)]]d^ 



(B13) 
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and 



E d = ^ll-(l-e B fA + ( Vsys () + 2 



7T-4f7 7 



e B (e B - 1)A+[k+(^)] + [2 + e B (e B - 3)]A+[ K -(ip)] 



-+n 



(l-e B ) 2 [A + [e + ^)]+A + [e^)]}d^ , 



(B14) 



and we solve these equations numerically. 



Appendix C: Estimation procedure 

The secret key rate formula given by Eq. (|13l) can be 
lower bounded by 

R l > gpacc{-Q7(^)^(^) + (pli / i+Po^)[l-ff(e 1 f )]}, 

(CI) 

where eY denotes an upper bound on the single-photon 
error rate e\. Hence, for our purposes, it is enough to 
obtain a lower bound on the quantities p\Yi + p Y for 
alH 6 {s, d}, together with eY ■ For that, we can directly 
use the results obtained in Ref. [l7j . which we include 
in this Appendix for completeness. The probabilities p l n 
given by Eq. (flO|) need to satisfy certain conditions that 
we confirm numerically. In particular, we have that 

iv , lv ^ j p\(pjQ s - p s 2 Q d ) 

{ PWi ~ P2P1 



and 



i _ i P2P0 - P2P0 

PO Pi d s s d 

PWi - P2P1 



Y o u ,0\, (C2) 



where Y U denotes an upper bound on the background 
rate Yq given by 



Y < Y U = min< 



E d Q d E S Q S 



Po e o P eo 



1 



(C3) 



with eo = 1/2. The single-photon error rate e\ can be 
upper bounded as 

. u . f E d Q d -p d Y L e E s Q°-p s Y L e 
ei < e\ — mm< - 



y Pi 1 ! 

p s Q E d Q d - p d E s Q s 



p\Yt 



(C4) 



where Y± and Y L represent, respectively, a lower bound 
on the yield Yi and the background rate Yq. These quan- 
tities are given by 

{ PWi - P2P1 J 

(C5) 



J pjQ s -P s iQ d 

1 d s s d ' 
{ P1P0 ~ P1P0 



Y a >Y-=m a ^ ^ ^ Q 



(C6) 



To evaluate these expressions we need the statistics 
p l n for n = 0,1,2. Using Eq. (fTTJj). and assuming again 
9\ = 7r/2, we obtain 

P S = A-{Q, (C7) 
P l = aA-(0-e- c (h <c -L- lx )], 

P2 = |{CA-(C) + e-< [|(l - y) + (1 - 20(/i,c 

-L_ u ) + C(/ 2lC -i 3 ,c)]}. 

and 

Po = A+(0, 

pi = <;[A + (0-e-Hh,t + L- lx )], 

c 



7T V 3 



l4 = ±{CA + (Q+e 

+ L_ liC ) + C(/ 2 ,c + i 2 ,c)]} 



(C8) 
(l-2C)(/i,C 



Appendix D: Asymptotic passive decoy-state BB84 
transmitter 

To evaluate the secret key rate formula given by 
Eq. (|T2"T) in this scenario, we consider that p s ss 1, and we 
assume that Alice and Bob can estimate the relevant pa- 
rameters Yq, Yi, and e\ perfectly. Moreover, we use the 
channel and detection models introduced in Appendix |B| 
In this situation, it turns out that the yields Yq and Y\ are 
given by Y = e B (2 - e B ) and Yi = 1 - (1 - Y )(l - ?7 sys ). 

The single-photon error rate e\ can be calculated us- 
ing Eqs. (lB8 j) - (|B12l) with = |1</,)(1</,|. After a short 
calculation, we obtain 



ei 



1 

2Yi 



To + (1 - £B) 2 ??sys " 



4(1 - e B )r] s 
7T - 4S1 



x sin ( — — fl 



(Dl) 



The resulting lower bound on the secret key rate is il- 
lustrated in Fig. [3] (red line) for the optimized parameters 
£ and fl. 
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